bcrypt

bcrypt was the first widely deployed password-hashing function explicitly designed to be slow and to scale with hardware via a tunable cost factor. It's still the safe default in many web frameworks because every language has a battle-tested implementation. The two reasons not to pick bcrypt for *new* designs in 2026: it caps input length at 72 bytes (longer passwords are silently truncated, a UX/security footgun), and it has no memory-hardness parameter, so a determined attacker with FPGAs / ASICs can crack it much faster than a defender can hash it. For storing new password hashes today, Argon2id is the better choice; for *verifying* existing bcrypt hashes during a migration, bcrypt is still appropriate.